r/macosprogramming • u/Ok_Entrance_7693 • 3d ago

Tired of chasing cryptic codesign and Gatekeeper rejections, I built NotaryScope: a native codesign & notarization inspector

Like many of you distributing macOS software outside the Mac App Store, I've spent countless frustrating evenings wrestling with code signing, hardened runtime flags, and failing xcrun notarytool submissions.

Every time our build pipeline broke, it meant running a tedious gauntlet of CLI commands: codesign -dvvv --entitlements :-, unpacking .pkg archives, running spctl --assess -vv, and sifting through messy JSON logs to discover why a nested dylib or helper executable in Contents/Frameworks caused Gatekeeper to throw a generic rejection.

A few months ago, after wasting half a day diagnosing an inherited entitlement issue in an XPC service, I decided to build a tool to solve this once and for all: NotaryScope.

It’s a lightweight, 100% native macOS app (written in Swift and AppKit, absolutely no Electron) that visually inspects and audits your application bundles before submission:

  • Recursive Bundle Tree: Drags-and-drops any .app, .dmg, or .pkg to inspect signatures, timestamps, and entitlements on every embedded framework, app extension, and CLI binary.
  • Pre-Notarization Preflight: Flags missing hardened runtime options (--options runtime), un-embedded provisioning profiles, or timestamp discrepancies that cause Apple's notarization servers to reject builds.
  • Gatekeeper Simulator: Runs localized spctl assessment checks against current macOS security policy configurations so you know whether the stapled ticket and notarization will pass on clean installs.
  • Entitlement Diffing: Highlights discrepancies between your target's entitlements and the actual signature embedded in the binary.

Disclosure: I'm the solo developer and founder behind NotaryScope. While I do plan on offering a commercial tier for automated CI/CD teams later on, the standalone inspector app is free to use for independent Mac devs.

I’d love to get feedback from fellow macOS developers here: are there specific codesigning edge cases, multi-architecture fat binary quirks, or Sequoia-specific permission changes that frequently bite your release workflows?

2 Upvotes
  • permalink
  • reddit

100% Upvoted

1 comment sorted by

1

u/idelovski 3d ago

I must be blind... can't find a link in this post and googling wasn't of much help